Commit Graph

905 Commits

Author SHA1 Message Date
Sebastian Gierlinger
2ee8f96829 Revert sessions to cookieSessions
no issue
- modified sessions to use cookieSession
- set max-age to 12 hrs
- modified logout to delete cookie completely
2013-10-18 13:24:01 +02:00
Hannah Wolfe
158d237122 Improved error handling
fixes #845

- only returns an error page for get requests, otherwise returns a response
- no more admin menu when not logged in
- no more error message about theme error template
- logWarn is available
2013-10-17 22:49:14 +01:00
Hannah Wolfe
f12a3cecf7 Fixing URL-based image uploads on settings screen 2013-10-17 21:54:51 +01:00
Hannah Wolfe
4f8ac2a4fd Current user data update 2013-10-17 21:38:49 +01:00
Hannah Wolfe
5916844835 Fixes for content screen
fixes #1125

- fixes an error in the console when there are no posts
- resolves the issue whereby content disappears after scroll
2013-10-17 21:06:01 +01:00
Jakob Gillich
0f048eeb79 Set correct HTTP status code on error
closes #1055
2013-10-17 21:52:40 +02:00
Hannah Wolfe
e29a598fa5 CSRF for debug screen 2013-10-17 20:52:09 +01:00
Hannah Wolfe
2a6e77752f API JSON updates 2013-10-17 20:52:05 +01:00
Hannah Wolfe
d9c9ca0e33 Merge pull request #4 from sebgie/sec/3
Sec/3
2013-10-17 10:49:40 -07:00
Hannah Wolfe
491651da59 Merge pull request #2 from ErisDS/bookshelf-knex-update
Updating to bookshelf 0.5.7 & knex 0.4.11
2013-10-17 10:49:28 -07:00
Tim Griesser
13639ad8d1 Updating to bookshelf 0.5.7 & knex 0.4.11 2013-10-17 18:23:36 +01:00
Sebastian Gierlinger
374c41e138 Remove private data from API
no issue
- added removal to user.browse, posts.read, posts.browse
- fixed removal for user.read
2013-10-17 17:15:25 +02:00
Sebastian Gierlinger
90176e1f40 Security improvements
no issue
- added CSRF protection
- changed session handling to express.session
- changed session handling to change session id
- added config property useCookieSession
- added file extension check for /ghost/upload
- removed /ghost/debug/db/reset
2013-10-17 15:28:28 +02:00
Hannah Wolfe
daa87e92c2 Merge pull request #1026 from jenius/master
Remove unneeded info from /user api response
2013-10-17 14:12:13 +01:00
John O'Nolan
1bd8002858 Fixed further firefox display bugs
See #1090

Conflicts:
	core/client/tpl/settings/user-profile.hbs
2013-10-17 14:10:49 +01:00
John O'Nolan
c6d805cd28 Merge pull request #1090 from bnchdrff/user-image-ff-fix
fixes firefox user image disappearance
2013-10-17 14:04:34 +01:00
Fabian Becker
dfa7793d44 Improved test coverage of theme helpers.
refs #246
2013-10-17 07:53:11 +00:00
Talon
675d02d466 fixed typo in comments of manage.scss
The mage posts screen is probably supposed to be the manage posts screen.
2013-10-16 20:43:59 -06:00
William Dibbern
702a016547 Fixed intermittent test errors
Fixes #1124

- Updated default mocha timeout to 15 seconds. Any future tests that
depend on a timeout (and thus might be better off with a lower value)
can override the default setting which is now 15 seconds.
- Removed test-specific timeout overrides for the mocha tests.
- Fixed the editor/splitbutton tests to wait for the appropriate
selector instead of assuming the dom has been updated immediately.
Should resolve intermittent timeouts when checking the splitbutton's
applied classes.
2013-10-16 17:57:52 -05:00
Fabian Becker
9a975f5a45 Posts can now be featured by clicking on the star icon
fixes #1111
2013-10-16 19:06:03 +00:00
William Dibbern
3e1b37e194 Simplify publish date checks
Fixes #814

- Changed to compare instances of `moment` using it's built in
comparison function instead of string compare with the date from the
database.
- Ensure compared date is parsed with the correct formats that we were
supporting before #1107.
- Moved date formats to variables to reduce chance for error in future.
2013-10-16 11:32:20 -05:00
Hannah Wolfe
9b879f6edb Merge pull request #1108 from nason/signupErrorHandler
Add otherwise error callback to redirectToSignup promise. Fixes #1071
2013-10-16 08:43:23 -07:00
nason
6a5e399997 Add error handling to redirectToSignup promise
Fixes #1078
- Add an otherwise error callback to the redirectToSignup promise
2013-10-16 08:39:58 -07:00
Michael Nason
7044d97d73 Save all settings when the logo or cover save button is clicked.
Fixes #1017.
- Call saveSettings for cover and blog logo photos
- Call saveUser for profile and profile cover photos
2013-10-16 08:39:24 -07:00
John O'Nolan
0e5dc9275c Fixed further firefox display bugs
See #1090
2013-10-16 17:26:28 +02:00
John O'Nolan
b1edd889b9 Merge pull request #1090 from bnchdrff/user-image-ff-fix
fixes firefox user image disappearance
2013-10-16 07:57:56 -07:00
Benjamin Chodoroff
672bb01d15 fixes firefox user image disappearance
take advice from @JohnONolan and subtract border-width
2013-10-16 10:47:06 -04:00
Fabian Becker
f4ac715f97 Add featured class when post is featured
fixes #1112
2013-10-16 11:41:49 +00:00
Hannah Wolfe
3eae0a3939 Merge pull request #1103 from b1nd/merge
Removed unused variables and updated commenting
2013-10-16 03:31:57 -07:00
Hannah Wolfe
7419e05b3a Merge pull request #1092 from halfdan/uc-helper
Added new helper to escape URIs called 'encode'
2013-10-16 02:23:13 -07:00
Fabian Becker
788987d04a Added new helper to escape URIs called 'encode'
fixes #1089
2013-10-16 09:19:26 +00:00
John O'Nolan
a76a702e6e Merge pull request #1098 from hansondr/floatingheader
tweaked .floatingheader background for non-webkit browsers
2013-10-16 01:18:31 -07:00
Karolis Dzeja
88d0303093 Fix notification bug
The date stored in the model is in a different format and needs to be converted before being checked. Otherwise, any blur event will trigger the notification that the date has been changed, even if the date is the same.
2013-10-16 00:30:25 -05:00
b1nd
c61806c1c8 Removed unused variables and updated commenting 2013-10-16 11:32:44 +11:00
abe33
c6b9b80e18 Fix style issue on user-image on Firefox and Opera
On both Firefox and Opera (OSX) the user image badge in
the settings page wasn't displayed.
Also, on firefox the badge overlay didn't have the proper size.

I don't know if there's a specific use case requiring a `display:
table` instead of a plain `display: block` but that was failing on
Firefox and Opera.

Using a block instead seems works perfectly (at least on Opera, Chrome,
Safari, Safari Mobile IOS7 and Firefox) regarding the badge size issue.

On Opera, though, the border radius wasn't applied properly to the
image. Adding a `border-radius: 100%;`fix that.
2013-10-16 00:25:03 +02:00
Daniel Hanson
0bcc111025 tweaked .floatingheader background for non-webkit browsers 2013-10-15 13:29:56 -06:00
Hannah Wolfe
930309363d Merge pull request #1020 from padhg/omit-uri-scheme
Allow omission of URI Scheme in config.js url
2013-10-15 12:26:18 -07:00
Jacob Kaplan-Moss
2acb546028 Fix #896 - work around errors in pagination under Postgresql. 2013-10-15 11:09:08 -05:00
William Dibbern
ac33cea0a1 Clean up test database after tests
Fixes #1064

- Updated grunt config for unit and functional tests to remove the test
database after each is run.
- Cleaned up a couple of issues with the functional tests that may have
been causing travis builds to fail randomly, including: the start page
is now `about:blank` instead of whatever page the last test suite left
off at, added some checks in the logout tests to ensure they're truly
independent of the other test suites.
2013-10-14 22:39:52 -05:00
Hannah Wolfe
18f78875ed Merge pull request #1050 from jgable/fixCssErrors
Fix extra semi-colon in sass
2013-10-14 14:53:25 -07:00
buddhamagnet
0662817cea Cache selector in afterRender function
- cache selector in a variable to prevent recomputing it in the function.
2013-10-14 20:56:20 +01:00
Hannah Wolfe
3cb955fb44 Merge pull request #1041 from halfdan/markdown-modal
Fix emphasize notation in Markdown modal.
2013-10-14 12:20:01 -07:00
Jeff Escalante
44973ba255 remove unneeded info from user api response 2013-10-14 15:07:52 -04:00
Fabian Becker
72f7404d2f Fix emphasize notation in Markdown modal.
fixes #1008
2013-10-14 18:12:55 +00:00
Jacob Gable
c153a3ca01 Fix extra semi-colon in sass
Related to #1033 but needs TryGhost/Casper#32 to close

- Remove extra semi-colon
2013-10-14 12:45:46 -05:00
Ryan Powell
dc1cf3b509 changes to support URI's without a scheme in config.js.
also removed "http:" from google fonts link to prevent a mixed content warning.
2013-10-14 10:42:08 -04:00
Hannah Wolfe
119b0ea430 Merge branch '0.3.2-wip'
Conflicts:
	core/client/assets/lib/uploader.js
2013-10-11 20:56:15 +01:00
Hannah Wolfe
b4e04b3650 Fix for image uploads
- express 3.4.0 uses connect 2.9.0 which had a sizable change to how multipart woks
- this change resulting in req.files.uploadimage.type going away
2013-10-11 20:26:09 +01:00
cobbspur
c52a10cd1a fixed image upload url synchronicity and url removed on cancel
closes #988, closes #956, closes #975

- fixed multiple ids and refactored triggers
- persistence requirement overridden
- trash can now removes url in editor
- if empty url is saved http:// is inserted and dropzone initialized

Conflicts:
	core/client/assets/lib/uploader.js
2013-10-11 18:15:17 +01:00
jamesbloomer
9d114c7fa6 Lock down theme static directory to not serve templates, markdown and text files.
closes #942
- insert custom middleware to check for blacklisted files
- redirect to express.static if file accepted
- if not valid return next() to do nothing
- currently black listing .hbs, .txt, .md and .json
- debatable which is best, black list or white list, either one will probably need tweaks but erred on side of letting
a theme serve unknown types
2013-10-11 18:05:31 +01:00
Sebastian Gierlinger
b040ea3365 Change from address
closes #872
- changed from address to use config.mail.fromaddress
- changed from address to default to settings.email
2013-10-11 12:49:33 +01:00
Hannah Wolfe
c732cd2ccb Adding xss unit test
issue #938
2013-10-10 16:43:25 +01:00
Hannah Wolfe
9466a9753b Merge branch '0.3.2-wip'
Conflicts:
	core/test/unit/api_posts_spec.js
2013-10-10 16:37:35 +01:00
Hannah Wolfe
31e2737cfd Update config validation to allow for socket only
issue #887
2013-10-10 16:13:02 +01:00
Patrick Garman
97f592aa41 Allow Ghost to run using sockets
Closes #887
- Adds getSocket function > Returns the socket location if sockets are enabled or false
- Adds startGhost function > Callback for server.listen
2013-10-10 16:12:28 +01:00
Hannah Wolfe
54f8a04779 Merge pull request #996 from ErisDS/0.3.2-tagfixes
Improving tag handling in post_class and body_class
2013-10-10 07:05:15 -07:00
Sebastian Gierlinger
6ff17c78a2 Fix filepaths for config and upload
no issue
- added appRoot to config-loader.js
- modified uploader to use correct path
- modified tests
2013-10-10 12:44:31 +02:00
Hannah Wolfe
f1317b84af Improving tag handling in post_class and body_class
closes #967, closes #987

- use slug instead of name (it's unique)
- get tags even if we aren't inside the post context
- add tag handling to body_class too
2013-10-09 19:51:55 +01:00
Hannah Wolfe
f5d617d8d4 Merge pull request #925 from matthojo/New-line
Added new paragraph keyboard shortcut
2013-10-09 11:32:43 -07:00
Hannah Wolfe
95f9fce3be Swapping escape to sanitze
issue #938

- rather than using escape, use node-validatiors santize function which is designed for preventing xss vectors
- added listener for changes to both editor and settings page
- added more sanitization to the user model
- consistently use triple-braces when outputting blog post titles
2013-10-09 19:13:16 +01:00
Tim Griesser
c9235ccb0b Escaping several fields to prevent XSS
issue #938
- escapes post's title field
- escapes settings title, description, email
- escapes user's name field
- includes test for post title
2013-10-09 19:13:13 +01:00
Hannah Wolfe
59d69f273e Merge pull request #984 from matthojo/Loading-Bar
Loading bar
2013-10-09 09:32:13 -07:00
Hannah Wolfe
b5c5d531d1 Fix for unhandled promise on fresh db startup
issue #977

- As of the addition of when/monitor/console we now get errors about unhandled promises
- This fixes one which appeared when starting up without a DB
2013-10-09 16:58:50 +01:00
Matthew Harrison-Jones
58417c2a8d Added in functionality for a working loading bar 2013-10-08 16:39:07 +01:00
Matthew Harrison-Jones
fdf5e3d69e Revert "loading bar implementation"
This reverts commit de6b8ee9b3 and 16742bcaef
2013-10-08 14:12:46 +01:00
William Dibbern
8ef27f0590 Refactored tests
Fixes #362

- There is no need to set the viewport on functional tests anymore
unless something other
than the default of 1280x1024 is desired.
- There is no need to invoke `casper.run` to trigger `test.done`
anymore for functional tests.
- Each test works independently of the rest; registration is handled
once for the lifetime of the test run and then login/logout can be
invoked automatically as desired.
- Mocha tests all utilize predefined, more realistic fixtures when
appropriate.
- Renamed old api tests that were really model tests as appropraite.
- Added example api test for posts.
2013-10-07 21:05:25 -05:00
Tim Griesser
ccd7b211f2 adding when/monitor/console 2013-10-07 09:28:53 -04:00
Hannah Wolfe
cd929f19b3 Merge pull request #954 from jgable/fixChangePasswordEnter
Fix pressing enter key on user settings
2013-10-05 12:25:26 -07:00
John O'Nolan
34762ce1be Move webfonts to // rather than http://
https://en.ghost.org/forum/bugs-suggestions/475-suggestion-remove-system-dependence-on-google-web-fonts
2013-10-04 09:48:51 +02:00
Hannah Wolfe
4bc8db57cc Merge pull request #918 from gotdibbs/Issue877
Fix a couple of issues when there are no posts
2013-10-03 07:40:11 -07:00
Hannah Wolfe
ba0b6982a4 Trailing slashes for cache invalidation headers
issue #963
2013-10-02 16:14:35 +01:00
Sebastian Gierlinger
40acf28321 Fix for dropzone
no issue
- dropzone is disabled when fileStorage = false
2013-10-02 13:34:16 +02:00
Sebastian Gierlinger
0220cf2448 Disable filestorage
closes #937
- fixed bug where ![] is replaced with ![](http://) for image url
- added fileStorage setting to uploader
- added fileStorage helper (could become standard way of providing config data for frontend???)
- added data element to editor and settings
- if no config value is set fileStorage: true is default
2013-10-02 11:39:34 +02:00
Jacob Gable
986d5c6299 Fix pressing enter key on user settings
Specified type='button' for the buttons in the form so they don't get
pseudo clicked on enter key in inputs.  Added a keyup handler to check
for enter keys in the inputs and do the proper action based on where you
are in the form.
2013-10-01 10:05:12 -05:00
Matthew Harrison-Jones
de6b8ee9b3 Refactored loading bar SCSS 2013-09-30 15:02:51 +01:00
John O'Nolan
16742bcaef Initial loading bar implementation
See #726

Becomes visible when <body> has a class of `js-loading`
2013-09-30 11:17:06 +02:00
John O'Nolan
8cbb09124d Smushed mobile app icons 2013-09-30 10:33:18 +02:00
Hannah Wolfe
17a0bd37b0 Merge pull request #930 from javorszky/iss840
Adds error message to blog import on empty / bad file
2013-09-29 11:10:08 -07:00
Gabor Javorszky
f709dcb798 Adds error message to blog import on empty / bad file
Closes #840
* Checks file to be size > 0
* Checks file to be .json
* Fails if either of them are not good
2013-09-28 15:42:42 +01:00
John O'Nolan
ba0ae3b4d8 Set sensible admin meta title 2013-09-28 16:21:59 +02:00
John O'Nolan
137a8dfc58 Adding support for Apple, Android, and Microsoft app icons 2013-09-28 15:54:12 +02:00
John O'Nolan
82f048c8fd Tidied up indentation/properties for default admin template 2013-09-28 15:00:17 +02:00
Hannah Wolfe
6bd62538af Merge branch '0.3.1-wip'
Conflicts:
	core/server/controllers/admin.js
2013-09-27 17:22:55 +01:00
Hannah Wolfe
a5bf8bf1e2 Removing reset button
- noone needs this, and someone is bound to press it and then complain.
2013-09-27 17:20:41 +01:00
Matthew Harrison-Jones
32aebc40d3 Added new paragraph keyboard shortcut
`Ctrl / Cmd + Enter` now enters a new paragraph, but only if the user is not on a new line.
2013-09-27 14:41:38 +01:00
Hannah Wolfe
e86958fdb7 Further fix to image markdown
issue #866 again
2013-09-27 14:17:19 +01:00
Hannah Wolfe
d841e749f9 Adding extra class for url uploads 2013-09-27 13:34:39 +01:00
Hannah Wolfe
ee8d8102db Merge pull request #923 from ErisDS/0.3.1-wip-mysql
0.3.1 wip mysql
2013-09-27 05:04:45 -07:00
Hannah Wolfe
5c10f6608c Unit Test fixes for MySQL
issue #858

- there is no guaranteed order to arrays, so sort before testing them
- tests run much faster, date comparisons fail
- settings tests are more explicit, otherwise they fail random validations
- dates must be inserted as date objects
2013-09-27 12:52:31 +01:00
Hannah Wolfe
d544b4aebb Custom destroy method for posts
issue #858

- correctly handles detaching tags before deleting the post
2013-09-27 11:56:20 +01:00
Hannah Wolfe
e6b779330f Correctly test for an empty Tag array
issue #858

- fixes syntax errors in mysql
2013-09-27 11:55:02 +01:00
Hannah Wolfe
71711c1fd2 Drop tables in correct order
issue #858

- unit tests now run for MySQL
2013-09-27 11:54:09 +01:00
Hannah Wolfe
50a16ceb76 Test Cleanup 2013-09-27 11:36:12 +01:00
Hannah Wolfe
e411ed6889 No autolinking inside of code blocks
closes #865

- rejigged markdown to have some functionality before showdown runs, and other functionality before.
- autolinking now happens last, so it can be smarter
2013-09-27 11:35:44 +01:00
Hannah Wolfe
8c6519fde7 Don't output image tag for empty source
closes #866

 - ensures we don't end up creating any more empty image tags.
2013-09-27 11:30:41 +01:00
John O'Nolan
9df4955bcb Fix tiny alignment issue on Ghost logo 2013-09-27 11:23:24 +02:00
John O'Nolan
8ce4d4b7c5 Fixed fucked up modal padding 2013-09-27 11:21:23 +02:00
Hannah Wolfe
6369eb20be Remove broken image from fixture
issue #866

- this fixes the problem inside the fixture
2013-09-27 09:18:02 +01:00
William Dibbern
c5438c5fff Fix couple of issues when there are no posts
Fixes #877

- Updated the blog/content view to check `collection.length` before
attempting to pull another record.
- In the event an item is removed and the collection now has zero items,
still redraw the preview pane, just with no data.
2013-09-26 23:44:01 -05:00
Hannah Wolfe
681aa71bf5 Merge pull request #848 from jamesbloomer/705-image-Upload-file-storage-amends-type
Use file mime type to check server side if image upload is a valid file
2013-09-26 15:18:04 -07:00